Brotli2Shell: Beyond Node(2Shell) and HTTP(2Shell)

Summary by Cyber Security News25 Oct 2026, 02:00 CET

About this summary. This is a short excerpt from the description that JFrog Security Research published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://research.jfrog.com/post/brotli2shell-beyond-node2shell-and-http2shell/

CVE-2026-111497 demonstrates how a single memory-corruption bug in a widely reused native decoder can affect applications far beyond the runtime where it was first discovered. CVE-2026-111497 was publicly disclosed in Node.js’s October 21 security release, which credited OpenAI Codex Security researchers Khai Tran and Sylvie Mayer with reporting the vulnerability.

Read the full article at JFrog Security Research →

Source attribution: headline and facts are from JFrog Security Research (research.jfrog.com). Summary method: excerpt of the source description. See our source attribution policy.